Which versions of AVer PTC Cameras are affected by CVE-2026-40624?

Critical remote code execution vulnerability in AVer PTC-series PTZ cameras (PTC500S, PTC115, PTC500+, PTC115+) with no available patch enables unauthenticated attackers to compromise video…

How to fix or mitigate CVE-2026-40624?

WITHIN 24 HOURS: Conduct complete inventory of all AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras in production; assess network exposure and criticality; isolate high-risk deployments from untrusted network segments. WITHIN 7 DAYS: Deploy firewall rules restricting HTTP access to cameras to authorized administrative networks only; enable detailed logging and alerting for suspicious HTTP requests targeting camera devices; document interim meeting solutions if critical cameras require temporary offline status. WITHIN 30 DAYS: Monitor AVer security advisories for vendor-released patch announcement; schedule immediate deployment within 48 hours of patch availability; evaluate hardware replacement timelines if no vendor patch materializes within 90 days; reassess video conferencing architecture to minimize future risk from legacy unpatched endpoints.

AVer PTC Cameras CVE-2026-40624

Q: What is the CVSS score of CVE-2026-40624?

CVE-2026-40624 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-37972 CRITICAL

Files or Directories Accessible to External Parties (CWE-552)

2026-06-18 icscert

GHSA-pg6m-mhv8-fpmp

RCE Information Disclosure Path Traversal Ptc500S Ptc115 Ptc500 Aver

9.3

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Web request to networked camera with no auth or interaction (AV:N/AC:L/PR:N/UI:N); arbitrary code execution yields full C/I/A impact on the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 00:33 vuln.today

CVSS changed

Jun 19, 2026 - 00:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

DescriptionCVE.org

Improper input validation in AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras may allow a remote, unauthenticated attacker to achieve arbitrary code execution via a specially crafted web request.

AnalysisAI

Remote code execution in AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras allows unauthenticated attackers to run arbitrary code by sending a specially crafted web request to the device's HTTP interface. The flaw was reported through CISA's ICS-CERT coordination process and carries a CVSS 4.0 base score of 9.3, but there is no public exploit identified at time of analysis and the CVE is not on the CISA KEV list.

Technical ContextAI

The affected products are AVer professional PTZ conference and tracking cameras (PTC500S, PTC115, PTC500+, PTC115+) that expose a web-based management/streaming interface, as confirmed by the four application-class CPEs (cpe:2.3:a:aver:ptc500s, ptc115, ptc500+, ptc115+). The root cause is mapped to CWE-552 (Files or Directories Accessible to External Parties), and the assigned tags (Information Disclosure, Path Traversal, RCE) indicate the input-validation weakness in the web request handler likely permits path traversal or unrestricted file access that can be escalated into code execution, e.g. by writing to or invoking executable resources on the camera's embedded Linux/RTOS firmware. Because AVer PTC cameras are typically deployed as networked IoT devices in conference rooms, classrooms, and broadcast environments, the HTTP attack surface is reachable from any host that can route to the device.

RemediationAI

No vendor-released patch version is identified in the available input data; defenders should consult the CISA advisory ICSA-26-169-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-01) and the corresponding CSAF document for the latest AVer firmware update and apply it as soon as it is published. Until a fixed firmware is installed, isolate the cameras on a dedicated management VLAN with no inbound access from user or guest networks, block the cameras' HTTP/HTTPS management ports (typically TCP/80 and TCP/443) at the perimeter and at any internal segment boundary, and restrict administrative access to a small allow-list of jump hosts - the trade-off is loss of remote browser-based management and potentially of cloud or mobile app features that rely on the web interface. If the camera offers a way to disable the embedded web server while retaining RTSP/streaming, doing so removes the vulnerable attack surface but will break the management UI; otherwise, place the device behind a reverse proxy that enforces authentication and strict URI filtering, accepting the operational cost of an additional component.